DEBUG

Author: vrutkovs

pkg/operator/certrotation/signer.go

@@ -158,10 +158,6 @@ func ensureOwnerReference(meta *metav1.ObjectMeta, owner *metav1.OwnerReference)
 func needNewSigningCertKeyPair(secret *corev1.Secret, refresh time.Duration, refreshOnlyWhenExpired bool) (bool, string) {
 	annotations := secret.Annotations
 	notBefore, notAfter, reason := getValidityFromAnnotations(annotations)
-	if len(reason) > 0 {
-		return true, reason
-	}
-
 	if time.Now().After(notAfter) {
 		return true, "already expired"
 	}
@@ -170,6 +166,10 @@ func needNewSigningCertKeyPair(secret *corev1.Secret, refresh time.Duration, ref
 		return false, ""
 	}
 
+	if len(reason) > 0 {
+		return true, reason
+	}
+
 	validity := notAfter.Sub(notBefore)
 	at80Percent := notAfter.Add(-validity / 5)
 	if time.Now().After(at80Percent) {
@@ -187,19 +187,23 @@ func needNewSigningCertKeyPair(secret *corev1.Secret, refresh time.Duration, ref
 func getValidityFromAnnotations(annotations map[string]string) (notBefore time.Time, notAfter time.Time, reason string) {
 	notAfterString := annotations[CertificateNotAfterAnnotation]
 	if len(notAfterString) == 0 {
+		klog.V(2).Infof("Validity from annotations %v: missing notAfter", annotations)
 		return notBefore, notAfter, "missing notAfter"
 	}
 	notAfter, err := time.Parse(time.RFC3339, notAfterString)
 	if err != nil {
-		return notBefore, notAfter, fmt.Sprintf("bad expiry: %q", notAfterString)
+		klog.V(2).Infof("Validity from annotations %v: bad notAfter expiry", annotations)
+		return notBefore, notAfter, fmt.Sprintf("bad notAfter expiry: %q", notAfterString)
 	}
 	notBeforeString := annotations[CertificateNotBeforeAnnotation]
-	if len(notAfterString) == 0 {
+	if len(notBeforeString) == 0 {
+		klog.V(2).Infof("Validity from annotations %v: missing notBefore", annotations)
 		return notBefore, notAfter, "missing notBefore"
 	}
 	notBefore, err = time.Parse(time.RFC3339, notBeforeString)
 	if err != nil {
-		return notBefore, notAfter, fmt.Sprintf("bad expiry: %q", notBeforeString)
+		klog.V(2).Infof("Validity from annotations %v: bad notBefore expiry", annotations)
+		return notBefore, notAfter, fmt.Sprintf("bad notBefore expiry: %q", notBeforeString)
 	}
 
 	return notBefore, notAfter, ""